I am not a security expert, and unfortunately we are too small company to have one. Since I am in charge of completing PCI DSS self-assessment questionnaires, I was shocked with the amount of questions specified.
First couple of questions are about firewall, network topology, routers etc, etc. Since we are an e-commerce and we host our web server on a remote location, I would really like to know are those questions regarding our web server or our office location.
Since we do not store or process any credit card information at our office location, we have chosen SAQ A -EP. but I am still not sure which network this questionnaire addresses?
If they are meant for our web server, how can I know all these network settings from a third party hosting. I contacted them (large hosting company) and they explained they did not have similar request.
Now I am confused did I got this process all wrong?